10

CVE-2021-28799

Warning

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Data is provided by the National Vulnerability Database (NVD)
Qnap ≫ Hybrid Backup Sync Version < 16.0.0415
   Qnap ≫ Qts Version4.5.2
Qnap ≫ Hybrid Backup Sync Version < 3.0.210412
   Qnap ≫ Qts Version4.3.6
Qnap ≫ Hybrid Backup Sync Version < 3.0.210411
   Qnap ≫ Qts Version4.3.3
   Qnap ≫ Qts Version4.3.4
Qnap ≫ Hybrid Backup Sync Version < 16.0.0419
   Qnap ≫ Quts Hero Versionh4.5.1
Qnap ≫ Hybrid Backup Sync Version < 16.0.0419
   Qnap ≫ Qutscloud Version >= c4.5.1 <= c4.5.4

31.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

QNAP NAS Improper Authorization Vulnerability

Vulnerability

QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 88.77% 0.995
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
security@qnapsecurity.com.tw 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.